registry / @clerk/clerk-js / 6.30.3
@clerk/clerk-js@6.30.3
Clerk JS library
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe manifest contains no install lifecycle hook, and the inspected entry bundle is consistent with a browser authentication library. Static network and dependency signals are package-aligned and do not establish malicious behavior.
Static reason
One or more suspicious static signals were detected.
Trigger
An application imports and initializes the Clerk SDK.
Impact
No unconsented install-time execution, local file access, persistence, or destructive behavior was found.
Mechanism
Browser authentication, wallet integration, and development telemetry.
AI rationale
The manifest contains no install lifecycle hook, and the inspected entry bundle is consistent with a browser authentication library. Static network and dependency signals are package-aligned and do not establish malicious behavior.
Decision evidence
public snapshotAI called this Clean at 97.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The runtime bundle includes a telemetry notice limited to development instances and an opt-out link.
- The manifest exposes the inspected Clerk browser and CommonJS entry points.
Evidence against
- package.json has no preinstall, install, or postinstall lifecycle hook.
- The inspected bundle showed browser authentication and wallet integration code, not shell execution, file harvesting, or install-time mutation.
- The declared Clerk and wallet dependencies explain the scanner's dependency-bridge and network signals.
Behavioral surface
ChildProcessCryptoNetwork
HighEntropyStringsMinifiedPossibleObfuscationProtestwareUrlStrings
Source & flagged code
3 flaggeddist/clerk.jsView file
61package = @clerk/clerk-js; repositoryIdentity = javascript; dependency = @zxcvbn-ts/core
L61: For more information contact us at ${t}`)}function ar(e){throw Error(`${t5} Calling ${e}.reload is not currently supported. Please contact support.`)}function an(e){throw Error(`${...
L62: API Error: ${n}`,{data:t,status:e})}}(i,e);let r={data:e,status:i};if(429===i&&o){let e=o.get("retry-after");if(e){let t=parseInt(e,10);isNaN(t)||(r.retryAfter=t)}}throw new U(t||s...
High
Copied Package Dependency Bridge
Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.
dist/clerk.jsView on unpkg · L6160"HUDSON_URL","BAMBOO_BUILDKEY","CF_PAGES"],ti=Symbol.for("@clerk/shared.telemetryNoticeShown"),ts=["Attention: Clerk collects telemetry data from its SDKs when connected to development instances.","The data collected is used to inform Clerk's product roadmap.","To learn more, including how to opt-out from the telemetry program, visit: https://clerk.com/docs/telemetry."];var to=class
Low
Ai Review Evidence
The runtime bundle includes a telemetry notice limited to development instances and an opt-out link.
dist/clerk.jsView on unpkg · L60package.jsonView file
Findings
1 High3 Medium5 Low
HighCopied Package Dependency Bridgedist/clerk.js
MediumNetwork
MediumProtestware
MediumStructural Risk Force Deep Review
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
LowAi Review Evidencedist/clerk.js
LowAi Review Evidencepackage.json
Affected versions and remediation
This report applies to @clerk/clerk-js@6.30.3.
See all versions of @clerk/clerk-js for other recorded verdicts.
- Review the evidence and your use of @clerk/clerk-js@6.30.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.